Using file upload facility, it is very easy to perform denial of service attack on any php script.

1. One should create an html form and set action to attacked php script.
2. In this form, indicate enctype="multipart/form-data" and set MAX_FILE_SIZE to a large enough value.
3. Select a large enough file and submit the form.
4. Repeat several times.

All files still resides at /tmp directory because the knows nothing about them.
Possible solution:
1. Deletion of the file by php engine at the end of script.
2. Explicit activation of upload processing of a file by a new function.